When WP Engine was blocked from accessing WordPress.org, users were left wondering what the future holds for ACF (Advanced Custom Fields) and how this ban will impact their sites moving forward.
ACF Blocked from WordPress.org
On October 03, 2024, ACF (Advanced Custom Fields) announced via X that “The ACF team has been blocked from accessing WordPress dot org and are unable to release updates for the free version of ACF.”
WP Engine, the owners of the ACF plugin, were earlier banned from accessing WordPress.org , which prevented the ACF team from deploying updates to the free version hosted on the platform. So the users were unable to automatically update ACF to newer versions. To help users, the ACF team shared a guide to manually update to the latest version of the plugin.
Customers of WP Engine or Flywheel, however, could still receive automatic updates for the free version. The ACF team assured users that “Recent events do not impact customers of ACF PRO. All updates of ACF PRO will continue to be served from advancedcustomfields.com and no action is required.”
They also noted, “While there are no pending security updates for ACF, this alternative update mechanism ensures your sites are ready to receive new features, bug fixes, and security updates going forward.”
Automattic’s Vulnerability Announcement
However, Automattic soon tweeted about a vulnerability in the plugin. The tweet was later deleted.
In response, John Blackbourn, WordPress Core Security Team Lead, tweeted, “Automattic has responsibly disclosed a vulnerability in ACF but breached the @Intigriti Code of Conduct by irresponsibly announcing it publicly. I am going to work my damned hardest to ensure that the fix gets shipped to dotorg if it affects the free version of ACF.”
Automattic has responsibly disclosed a vulnerability in ACF but breached the @Intigriti